Back to top

Career update: Director Security Services at Acquia

I recently accepted a position as an employee at Acquia. I have been "my own boss" since about 2006. I had a brief stint as a part-time employee at a company that has now ceased operations, but for the most part I've been the "owner" of GVS.

Thoughts on GVS

I founded GVS with a few goals. I wanted a company that mirrored open source values of do-ocracy and collaborative decision making. In part this was to make it easy for us to hire community rock-stars and have them feel right at home. In reality that didn't work perfectly though it worked pretty darn well. In part this was because I don't really like being a "manager" and wanted to have an empowered independent team. That mostly worked :)

GVS has had a ton of amazing clients and projects. Some of my personal highlights I'm most proud of are the work on, California Closets, and the Drupalcon Chicago site which really helped push forward the COD platform. Not everything turned out perfectly. We had our fair share of mistakes but I think in the end we at least were honest and did our best to deliver what we promised and what the client wanted.

One of the real highlights was that working at GVS allowed me to take a 9 month long trip through Spain, Argentina, Uruguay, Chile, Bolivia, and Peru with my wonderful wife. We visited 30+ wineries, drastically improved our Spanish, and had an amazing time. I've asked every employer I worked for to support me in doing that and none really did. Working for myself I could do that. Of course, it was a lot of work to make that a reality. I had to be aggressive about accepting certain clients that would be flexible with me while I was abroad and on flakey internet connections. I also used that time strategically by investing much more than normal in my community work which has had long term marketing benefits.

On learning that I "owned" a company people often will say to me "being the boss must be great! I bet you never work and go on vacation all the time!" Falser words could not be spoken. Whether you are a freelancer or owner of a small business your real boss is your clients. Whether that's a small number of folks who each pay you a lot or hundreds or thousands of customers for a always have a boss who makes demands.

One of the toughest things about running this company was hiring (and firing) people. My father in law preaches the idea you should "hire slowly and fire quickly." Of course in reality he has too much faith in people to improve and doesn't follow that advice. I couldn't follow it either and the few times GVS fired or lost employees were difficult.

Our strategy was to be a boutique firm without managers or sales people. We built our budget around contributing over 20% of our revenue to the Drupal community, primarily in the form of working on community projects like our modules. That contribution would be our sales vehicle and it mostly worked. Everyone worked directly with clients. For big projects we might choose a "project lead" who tried to make sure the team had enough time to give to the project to get things done, but there was no manager in charge of being nice to clients and in charge of developers - we were all responsible for that. So hiring slowly fits well into that strategy and we mostly followed that part of the mantra.

From a process perspective we did company and individual goal setting sessions at least once every 9 months. Based on my own feelings and discussions with others I would create goals for the company. Then each individual set their own goals and we talked about them as a team. Then we would all complete peer reviews using a simplistic spreadsheet that had 9 criteria and space for comments. I reviewed these peer-reviews with each employee and discussed ways to improve. Ezra, as the most senior team member, led my review :)

Thoughts on Acquia

I am really excited to be working at Acquia. My current passion is in improving the security of Drupal sites. Drupal sites can be made insecure through a mistake here, a code mixup over there, and a theme printing error in that little tpl.php that was changed. For the past few years this has increasingly become my main area of work. With my colleague Ben I did several manual reviews of sites and we started building several automated tools to evaluate security. Our vision was to do manual reviews to fund development of the automated tools and then release the automated tools at a low price point to provide the benefit of our work to a large audience (and of course make some money in the process).

That dream may be possible, but it's a lot of work to attack on our own. We approached a lot of potential partners to see how to grow this service and found that we were extremely excited about how our vision of securing lots of sites could live on inside of the talented team of folks at Acquia. They've built and launched multiple successful products. They have a world class team in engineering, product management, marketing, sales, and professional services. Rather than having to wear all those hats, we can trust and rely on our colleagues to get those things done while Ben and I focus on security work. One big part of our dream was to hire more people. We want to bring in folks from "outside Drupal' to grow our expertise and capacity for handling issues via the volunteer Security Team. Acquia shares that vision for growing a team of security experts and is hiring. Please get in touch if you match that description.

This team and their mix of services also gives Acquia one amazingly tempting element: scale. Where else will someone working on interesting problems in Drupal have the opportunity to work on services that can be deployed to tens or hundreds of thousands of sites overnight? What other firms are working across the world to serve so many customers? Maybe others have that same vision, but Acquia is there now and only looking to go further.

I will be wholly honest: I was skeptical of Acquia at first. They bring a VC backed, enterprise-focused, sales-heavy perspective to a grassroots open source community with a strong contingent that is quite anti-establishment. I think it's easy for folks in our community to get caught up in making fun of the mistakes Acquia has made or the ways that certain members of the press mis-represent the reality of the Acquia story. I truly believe the places where Acquia has made mistakes were just that and not malicious. As we talked about partnerships and I spent more time with Acquia folks at camps I started realizing that they are really great people who have amazing ideas about how to grow Drupal. They are passionate about being honest to the Drupal community values and interested in learning them.

Now that I will be working for Acquia, I hope folks will share their thoughts with me about anything Acquia does that feels like it's at odds with the overall Drupal project - I promise I will do my best to address those issues (it's not hard to make that promise, Dries made it to me a month ago).

One element of Acquia's business plan that I really like is Acquia's dedication to both enterprise AND small sites (via Drupal Gardens). This makes sure they won't "forget about people on $2/month shared hosting" as they work to make Drupal excel for the biggest and most specialized clients.

So that's about it! A new job. I'm excited to be an employee again and looking forward to working the amazing team of folks at Acquia. For more details on this change see post, post, and Certified to Rock post.

People Involved: 



Not just on getting acquired by Acquia, but also for the ways you did business in the years leading towards this. It takes a lot of effort and insight to pull this off.


Thanks for GVS Greg, it was a truly great company and I never once had a bad thing to say about the purpose and intents of GVS. You guys did a great thing attempting to counter an Acquia-dominated certification program with Certified to Rock, and I hope that your insight helps foster collaboration between Acquia with the community.

Fantastic news

good luck at your new job at Acquia. more excuses to come to Boston I guess :)


Congratulations Gregg! I really liked your post explaining your thoughts and reasoning behind your choice. Wishing you the best in the coming months and years there!